hammerkit 1.6.0 → 1.7.0

package/dist/executer/scheduler/state-key.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeStateKey = exports.combineStateKeys = exports.resolveEffective = void 0;
+const crypto_1 = require("crypto");
+const get_work_cache_stats_1 = require("../../optimizer/get-work-cache-stats");
+// The state-key engine is shared by the scheduler's hit/miss decision
+// (`checkCacheState`) and the read-only cache-explain engine, so a prediction
+// can never diverge from the decision it predicts — there is one implementation.
+function resolveEffective(item, fallbackMethod) {
+    const declared = item.data.caching;
+    if (declared.implicit) {
+        return { ...declared, method: fallbackMethod };
+    }
+    return declared;
+}
+exports.resolveEffective = resolveEffective;
+// A task whose inputs cannot be observed cannot be proven up to date, so it
+// always runs, and so does everything depending on it (specs/task SC-001). That
+// is a task that declares no `src` of its own — the sources it inherits from its
+// dependencies say nothing about the files its own commands read — and a task
+// whose `src` entries all match no file (a typo, a moved path). Services are not
+// affected.
+function isOwnProvable(item, unmatched) {
+    // unmatched ⊆ declared, so this is also false when nothing is declared
+    return unmatched.length < item.data.src.filter((src) => !src.inherited).length;
+}
+// Fold a task's own state key together with the state keys of its dependencies.
+// A change anywhere in the dependency subtree must change the resulting key, so
+// that a downstream task is invalidated when an upstream source changes — even
+// if the downstream task's own sources are untouched.
+function combineStateKeys(ownKey, depKeys) {
+    if (depKeys.length === 0) {
+        return ownKey;
+    }
+    // Sort so the key is independent of dependency declaration order.
+    const sorted = [...depKeys].sort();
+    return (0, crypto_1.createHash)('md5')
+        .update([ownKey, ...sorted].join(','))
+        .digest('hex');
+}
+exports.combineStateKeys = combineStateKeys;
+// `none` only disables the cache *check* for a task; its sources still influence
+// what depends on it, so a concrete method is always used for the hash itself.
+function concreteMethod(resolved, defaultCacheMethod) {
+    return resolved.method === 'none' ? defaultCacheMethod : resolved.method;
+}
+// Compute an item's effective state key from its source files plus the effective
+// state keys of its dependencies, recursively. This is derived purely from the
+// work tree and the filesystem, so it does not depend on scheduler/run state —
+// important because it runs before dependencies are awaited.
+async function resolveEffectiveStateKey(item, defaultCacheMethod, environment, memo) {
+    const existing = memo.get(item.id());
+    if (existing !== undefined) {
+        return existing;
+    }
+    const { stateKey, provable } = await computeStateKey(item, defaultCacheMethod, environment, memo);
+    const effective = { stateKey, provable };
+    memo.set(item.id(), effective);
+    return effective;
+}
+// Compute the combined state key for a single item together with the source
+// stats it was derived from, sharing one filesystem walk with callers that also
+// need the stats (the scheduler, the explain engine).
+async function computeStateKey(item, defaultCacheMethod, environment, memo = new Map()) {
+    const resolved = resolveEffective(item, defaultCacheMethod);
+    const { stats, unmatched } = await (0, get_work_cache_stats_1.getWorkItemCacheStats)(item, environment);
+    const ownKey = (0, get_work_cache_stats_1.getStateKey)(stats, concreteMethod(resolved, defaultCacheMethod));
+    const depKeys = [];
+    let provable = isOwnProvable(item, unmatched);
+    for (const dep of item.deps) {
+        const effective = await resolveEffectiveStateKey(dep, defaultCacheMethod, environment, memo);
+        depKeys.push(effective.stateKey);
+        provable = provable && effective.provable;
+    }
+    return { stateKey: combineStateKeys(ownKey, depKeys), stats, resolved, provable, unmatched };
+}
+exports.computeStateKey = computeStateKey;
+//# sourceMappingURL=state-key.js.map

package/dist/kubernetes/await-running-state.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.awaitDeployRunningState = exports.awaitJobState = exports.awaitRunningState = void 0;
+exports.deleteJobAndWait = exports.awaitDeployRunningState = exports.deleteJob = exports.awaitJobCompletion = exports.awaitRunningState = void 0;
+const abort_1 = require("../executer/abort");
+const abort_event_1 = require("../utils/abort-event");
+const apply_1 = require("./apply");
 function awaitRunningState(instance, env, name, phase) {
     return new Promise((resolve, reject) => {
         const req = instance.watch.watch(`/api/v1/namespaces/${env.namespace}/pods`, {}, (type, obj) => {
@@ -22,27 +25,56 @@ function awaitRunningState(instance, env, name, phase) {
     });
 }
 exports.awaitRunningState = awaitRunningState;
-function awaitJobState(instance, env, name) {
-    return new Promise((resolve, reject) => {
-        const req = instance.watch.watch(`/apis/batch/v1/namespaces/${env.namespace}/jobs/${name}`, {}, (type, obj) => {
-            if (obj && obj.metadata?.name === name && obj.metadata?.namespace === env.namespace && obj.status?.succeeded) {
-                req.then((r) => r.abort());
-                resolve();
-            }
-        }, (err) => {
-            if (err && err.message === 'aborted') {
-                return;
-            }
-            if (err) {
-                reject(err);
-            }
-            else {
-                resolve();
-            }
+// Wait for a job to finish by polling its status: resolves once it succeeded,
+// rejects when it failed (its `Failed` condition, i.e. retries are exhausted).
+// On abort the job is deleted — with its pods — and an AbortError is thrown, so
+// a cancelled or timed-out task leaves nothing running on the cluster.
+async function awaitJobCompletion(instance, env, name, abort, pollInterval = 1000) {
+    for (;;) {
+        if (abort.aborted) {
+            await deleteJob(instance, env, name);
+            throw new abort_1.AbortError();
+        }
+        const job = await instance.batchApi.readNamespacedJobStatus(name, env.namespace);
+        const status = job.body.status;
+        if (status?.succeeded) {
+            return;
+        }
+        const failed = status?.conditions?.find((c) => c.type === 'Failed' && c.status === 'True');
+        if (failed) {
+            throw new Error(`job ${name} failed: ${failed.message ?? failed.reason ?? 'unknown reason'}`);
+        }
+        await sleep(pollInterval, abort);
+    }
+}
+exports.awaitJobCompletion = awaitJobCompletion;
+function sleep(ms, abort) {
+    if (abort.aborted) {
+        return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            listener.close();
+            resolve();
+        }, ms);
+        // not aborted yet, so this callback can only fire later, after assignment
+        const listener = (0, abort_event_1.listenOnAbort)(abort, () => {
+            clearTimeout(timer);
+            resolve();
         });
     });
 }
-exports.awaitJobState = awaitJobState;
+async function deleteJob(instance, env, name) {
+    try {
+        await instance.batchApi.deleteNamespacedJob(name, env.namespace, undefined, undefined, 0, undefined, 'Background');
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) !== 404) {
+            throw e;
+        }
+    }
+}
+exports.deleteJob = deleteJob;
 function awaitDeployRunningState(instance, env, name) {
     return new Promise((resolve, reject) => {
         const req = instance.watch.watch(`/apis/apps/v1/namespaces/${env.namespace}/deployments`, {}, (type, obj) => {
@@ -68,4 +100,26 @@ function awaitDeployRunningState(instance, env, name) {
     });
 }
 exports.awaitDeployRunningState = awaitDeployRunningState;
+// Delete a job and wait until it is gone: its name is reused for the task's next
+// command (and the next run with the same state), and creating it while the old
+// one is still being deleted would pick up the old job.
+async function deleteJobAndWait(instance, env, name, abort, pollInterval = 500) {
+    await deleteJob(instance, env, name);
+    for (;;) {
+        try {
+            await instance.batchApi.readNamespacedJob(name, env.namespace);
+        }
+        catch (e) {
+            if ((0, apply_1.statusCodeOf)(e) === 404) {
+                return;
+            }
+            throw e;
+        }
+        if (abort.aborted) {
+            throw new abort_1.AbortError();
+        }
+        await sleep(pollInterval, abort);
+    }
+}
+exports.deleteJobAndWait = deleteJobAndWait;
 //# sourceMappingURL=await-running-state.js.map

package/dist/log.js

@@ -109,9 +109,14 @@ async function printWorkTreeResult(schedulerState, env) {
     for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(schedulerState)) {
         let message = `${formatDate(new Date())} ${getType('task')} ${getNodeName(task.name, maxNodeNameLength)} - ${getStateText(task.state.current)}`;
         if (task.state.current.type === 'completed') {
-            message += ` in ${task.state.current.duration}ms`;
-            if (task.state.current.cached) {
-                message += ' [CACHED]';
+            if (task.state.current.skipped) {
+                message += ' [SKIPPED]';
+            }
+            else {
+                message += ` in ${task.state.current.duration}ms`;
+                if (task.state.current.cached) {
+                    message += ' [CACHED]';
+                }
             }
         }
         if (task.state.current.type === 'crash') {
@@ -263,9 +268,14 @@ function writeWorkTreeStatus(schedulerState, env, ticker) {
             }
         }
         else if (task.state.current.type === 'completed') {
-            message += ` in ${task.state.current.duration}ms`;
-            if (task.state.current.cached) {
-                message += ' [CACHED]';
+            if (task.state.current.skipped) {
+                message += ' [SKIPPED]';
+            }
+            else {
+                message += ` in ${task.state.current.duration}ms`;
+                if (task.state.current.cached) {
+                    message += ' [CACHED]';
+                }
             }
         }
         else if (task.state.current.type === 'error') {

package/dist/logging/live-logger.js

@@ -4,11 +4,12 @@ exports.liveLogger = void 0;
 const log_1 = require("../log");
 function liveLogger(state, env) {
     const maxNodeNameLength = (0, log_1.getWorkItemMaxLength)(state.current);
-    env.status.on((log) => {
+    const listener = env.status.on((log) => {
         (0, log_1.writeWorkItemLogToConsole)(env, log, maxNodeNameLength);
     });
     return {
         async complete(evt, env) {
+            listener.close();
             await (0, log_1.printWorkTreeResult)(evt.state, env);
         },
     };

package/dist/optimizer/calculate-checksum.js

@@ -2,9 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.calculateChecksum = void 0;
 const crypto_1 = require("crypto");
+// Hashes the raw bytes: decoding to text first would map every invalid UTF-8
+// sequence to U+FFFD, so two different binary files could share a checksum.
+// For UTF-8 text the result is unchanged.
 async function calculateChecksum(environment, path) {
-    const input = await environment.file.read(path);
-    return (0, crypto_1.createHash)('sha1').update(input).digest('hex');
+    const hash = (0, crypto_1.createHash)('sha1');
+    for await (const chunk of environment.file.readStream(path)) {
+        hash.update(chunk);
+    }
+    return hash.digest('hex');
 }
 exports.calculateChecksum = calculateChecksum;
 //# sourceMappingURL=calculate-checksum.js.map

package/dist/optimizer/get-work-cache-stats.js

@@ -1,45 +1,95 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getStateKey = exports.getWorkCacheStats = void 0;
+exports.getStateKey = exports.getWorkItemCacheStats = exports.getWorkCacheStats = void 0;
 const calculate_checksum_1 = require("./calculate-checksum");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
-async function addWorkCacheStats(result, cwd, path, matcher, context) {
+function isExcluded(path, excluded) {
+    return excluded.some((excludedPath) => path === excludedPath || path.startsWith(excludedPath + path_1.sep));
+}
+async function addWorkCacheStats(result, cwd, path, matcher, context, root, excluded) {
+    if (isExcluded(path, excluded)) {
+        return 0;
+    }
     const exists = await context.file.exists(path);
     if (!exists) {
-        return;
+        return 0;
     }
     const stats = await context.file.stats(path);
     if (stats.type === 'file') {
-        if (matcher(path)) {
-            const checksum = await (0, calculate_checksum_1.calculateChecksum)(context, path);
-            result.files[(0, path_1.relative)(cwd, path)] = { lastModified: stats.lastModified, checksum };
+        if (!matcher(path)) {
+            return 0;
         }
+        const checksum = await (0, calculate_checksum_1.calculateChecksum)(context, path);
+        // '/'-separated on every OS, so a Windows host keys a container task like Linux
+        result.files[(0, path_1.relative)(cwd, path).split(path_1.sep).join(path_1.posix.sep)] = { lastModified: stats.lastModified, checksum };
+        return 1;
     }
     else if (stats.type === 'directory') {
-        const files = await context.file.listFiles(path);
-        for (const file of files) {
-            const subPath = (0, path_1.join)(path, file);
-            if (matcher(subPath)) {
-                await addWorkCacheStats(result, cwd, (0, path_1.join)(path, file), matcher, context);
-            }
+        // A glob such as src/**/*.ts never matches a directory itself, so a
+        // directory is walked when files inside it could match.
+        if (!root && !matcher(path, true)) {
+            return 0;
+        }
+        let matched = 0;
+        for (const file of await context.file.listFiles(path)) {
+            matched += await addWorkCacheStats(result, cwd, (0, path_1.join)(path, file), matcher, context, false, excluded);
         }
+        return matched;
     }
+    return 0;
 }
 async function getWorkCacheStats(work, environment) {
+    return (await collectSourceStats(work, environment, [])).stats;
+}
+exports.getWorkCacheStats = getWorkCacheStats;
+// `excluded` paths are left out of the walk, see getWorkItemCacheStats. A src
+// entry inside an excluded path is represented there, so it is never unmatched.
+async function collectSourceStats(work, environment, excluded) {
     const result = {
         created: new Date(),
         files: {},
     };
+    const unmatched = [];
     for (const src of work.src) {
-        await addWorkCacheStats(result, work.cwd, src.absolutePath, (file) => src.matcher(file, work.cwd), environment);
+        const matcher = (file, partial) => src.matcher(file, work.cwd, partial);
+        const matched = await addWorkCacheStats(result, work.cwd, src.absolutePath, matcher, environment, true, excluded);
+        if (matched === 0 && !src.inherited && !isExcluded(src.absolutePath, excluded)) {
+            unmatched.push(src);
+        }
     }
-    return result;
+    return { stats: result, unmatched };
+}
+// The source stats of a task or service, leaving out everything its (transitive)
+// dependencies generate. Those outputs are already represented by the
+// dependencies' task ids and state keys — and hashing them would key the item
+// differently before and after its dependencies ran, since the key is computed
+// before they do.
+function getWorkItemCacheStats(item, environment) {
+    return collectSourceStats(item.data, environment, dependencyOutputs(item));
+}
+exports.getWorkItemCacheStats = getWorkItemCacheStats;
+function dependencyOutputs(item) {
+    const outputs = new Set();
+    const visited = new Set();
+    const visit = (dep) => {
+        if (visited.has(dep)) {
+            return;
+        }
+        visited.add(dep);
+        for (const generate of dep.data.generates) {
+            outputs.add(generate.path);
+        }
+        dep.deps.forEach(visit);
+    };
+    item.deps.forEach(visit);
+    return [...outputs];
 }
-exports.getWorkCacheStats = getWorkCacheStats;
 function getStateKey(stats, cacheMethod) {
     const contents = [];
-    for (const key of Object.keys(stats.files)) {
+    // Sorted: the walk follows the filesystem's listing order, which differs
+    // between machines (ext4 and overlayfs list in hash order).
+    for (const key of Object.keys(stats.files).sort()) {
         if (cacheMethod === 'checksum') {
             contents.push(`${key}:${stats.files[key].checksum}`);
         }

package/dist/optimizer/work-task-cache-description.js

@@ -1,14 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getWorkTaskCacheDescription = void 0;
+exports.storedCacheDescription = exports.getWorkTaskCacheDescription = void 0;
 const os_1 = require("os");
+const crypto_1 = require("crypto");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
-function getWorkTaskCacheDescription(task) {
+const portable_path_1 = require("../planner/utils/portable-path");
+// Every path is made project-relative (portablePath) so the description, and the
+// task id hashed from it, is identical wherever the project is checked out.
+//
+// `deps` holds the dependencies' task ids, so a change to a dependency's
+// definition (command, env, image, …) gives every task depending on it a new id.
+// The state key only folds in the dependencies' *sources*.
+function getWorkTaskCacheDescription(item) {
+    const task = item.data;
+    const portable = (path) => (0, portable_path_1.portablePath)(task.projectRoot, path);
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(task.envs);
     return {
         shell: task.shell ?? undefined,
         platform: task.type === 'container-task' ? task.image : (0, os_1.platform)(),
-        generates: task.generates.map((g) => g.path).sort() ?? undefined,
+        // outputs hold native binaries, and docker pulls images for the host
+        // architecture, so container tasks are keyed by it too
+        arch: process.arch,
+        generates: task.generates.map((g) => portable(g.path)).sort() ?? undefined,
         src: task.src.map((s) => s.source).sort() ?? undefined,
         envs: Object.keys(envs)
             .sort()
@@ -16,10 +29,26 @@ function getWorkTaskCacheDescription(task) {
             map[key] = envs[key];
             return map;
         }, {}) ?? undefined,
-        cmds: task.cmds.map((c) => ({ cmd: c.cmd, cwd: c.cwd })),
+        cmds: task.cmds.map((c) => ({ cmd: c.cmd, cwd: portable(c.cwd) })),
         mounts: task.type === 'container-task' ? task.mounts.map((m) => m.mount).sort() : undefined,
-        cwd: task.cwd,
+        cwd: portable(task.cwd),
+        deps: item.deps.length > 0 ? item.deps.map((dep) => dep.id()).sort() : undefined,
     };
 }
 exports.getWorkTaskCacheDescription = getWorkTaskCacheDescription;
+// The form written to disk: description.json in a cache entry (pushed to remote
+// backends, readable by everyone who can pull) and the local explain record.
+// Env is where tokens get passed, so each value is stored as a digest; the task
+// id is still hashed from the values themselves.
+function storedCacheDescription(description) {
+    if (!description.envs) {
+        return description;
+    }
+    const envs = {};
+    for (const [key, value] of Object.entries(description.envs)) {
+        envs[key] = `sha256:${(0, crypto_1.createHash)('sha256').update(value).digest('hex')}`;
+    }
+    return { ...description, envs };
+}
+exports.storedCacheDescription = storedCacheDescription;
 //# sourceMappingURL=work-task-cache-description.js.map

package/dist/planner/project-root.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findProjectRoot = void 0;
+const path_1 = require("path");
+// The project root anchors cache identity: every path that participates in a
+// task or service id is expressed relative to it, so the same checkout yields the
+// same ids wherever it lives (an agent sandbox, a CI runner, a laptop). The git
+// root is used when there is one, so the root does not move with the build file
+// the CLI was invoked with (`-f apps/web/.hammerkit.yaml` vs the repo root);
+// otherwise the directory of the main build file.
+async function findProjectRoot(buildFileDirectory, environment) {
+    let current = buildFileDirectory;
+    for (;;) {
+        // `.git` is a directory in a normal clone and a file in a worktree/submodule
+        if (await environment.file.exists((0, path_1.join)(current, '.git'))) {
+            return current;
+        }
+        const parent = (0, path_1.dirname)(current);
+        if (parent === current) {
+            return buildFileDirectory;
+        }
+        current = parent;
+    }
+}
+exports.findProjectRoot = findProjectRoot;
+//# sourceMappingURL=project-root.js.map

package/dist/planner/utils/append-work-service.js

@@ -51,6 +51,7 @@ function parseService(workTree, service, environment, context) {
     const envs = (0, replace_env_variables_1.buildEnvironmentVariables)(service.envs, environment, context);
     const workService = {
         cwd: service.cwd,
+        projectRoot: context.projectRoot,
         name: service.relativeName,
         ports: (0, parse_work_ports_1.parseWorkPorts)(service.schema, envs),
         scope: service.scope,
@@ -94,7 +95,7 @@ function parseService(workTree, service, environment, context) {
                 }
                 : null,
             envs: (0, replace_env_variables_1.buildEnvironmentVariables)(service.envs, environment, context),
-            image: service.schema.image,
+            image: (0, template_value_1.templateValue)(service.schema.image, envs),
             cwd: service.cwd,
             cmd: service.schema.cmd ? (0, parse_work_command_1.parseWorkCommand)(service.cwd, service.schema.cmd, envs) : null,
             volumes: (0, parse_work_volume_1.parseWorkVolumes)(service.cwd, service.schema.volumes, envs),

package/dist/planner/utils/append-work-task.js

@@ -16,11 +16,15 @@ const replace_env_variables_1 = require("../../environment/replace-env-variables
 const lazy_resolver_1 = require("../../executer/lazy-resolver");
 const get_work_runtime_1 = require("./get-work-runtime");
 const resolve_cache_1 = require("../../cache/resolve-cache");
+const units_1 = require("../../utils/units");
 function appendWorkTask(workTree, cwd, referenceTask, environment, context) {
     const task = parseTask(cwd, referenceTask, environment, context);
     if (!workTree.tasks[task.name]) {
         const workItem = {
-            id: (0, lazy_resolver_1.lazyResolver)(() => (0, work_cache_id_1.getWorkTaskId)(task)),
+            // A dependency cycle is rejected before anything runs (checkForLoop), but
+            // the id may be asked for earlier; re-entry yields a placeholder instead of
+            // recursing forever.
+            id: (0, lazy_resolver_1.lazyResolver)(() => (0, work_cache_id_1.getWorkTaskId)(workItem), () => `cycle:${task.name}`),
             name: task.name,
             data: task,
             status: environment.status.from(task),
@@ -53,6 +57,7 @@ function parseTask(cwd, task, environment, context) {
         description: (0, template_value_1.templateValue)(task.schema.description || '', envs).trim(),
         name: task.relativeName,
         cwd,
+        projectRoot: context.projectRoot,
         cmds: (0, parse_work_command_1.parseWorkCommands)(cwd, task.schema.cmds || [], envs),
         src: (0, parse_work_source_1.parseWorkSource)(cwd, task.schema.src, envs),
         generates: (0, parse_work_generate_1.parseWorkGenerate)(cwd, task.schema, envs),
@@ -61,6 +66,7 @@ function parseTask(cwd, task, environment, context) {
         caching: (0, resolve_cache_1.resolveCache)(task.schema.cache ?? null, context.caches, task.relativeName),
         shell: task.schema.shell ? (0, template_value_1.templateValue)(task.schema.shell, envs) : '/bin/sh',
         continuous: task.schema.continuous ?? false,
+        timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
     };
     if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
         return {

package/dist/planner/utils/parse-work-source.js

@@ -15,38 +15,25 @@ function parseWorkSource(cwd, sources, envs) {
         return result;
     }
     for (const source of sources) {
-        const wildcardIndex = source.indexOf('*');
-        if (wildcardIndex >= 0) {
-            if (wildcardIndex === 0) {
-                const absolutePath = cwd;
-                result.push({
-                    matcher: (file, cwd) => {
-                        const matcher = new minimatch_1.Minimatch(source, { dot: true });
-                        return matcher.match(toPosix((0, path_1.relative)(cwd, file)));
-                    },
-                    inherited: null,
-                    source,
-                    absolutePath,
-                    isFile: false,
-                });
-            }
-            else {
-                const prefixSource = source.substring(0, wildcardIndex);
-                const absolutePath = (0, path_1.join)(cwd, (0, template_value_1.templateValue)(prefixSource, envs));
-                result.push({
-                    matcher: (file, cwd) => {
-                        const matcher = new minimatch_1.Minimatch(toPosix((0, path_1.join)(cwd, source)), { dot: true });
-                        return matcher.match(toPosix(file));
-                    },
-                    inherited: null,
-                    source,
-                    absolutePath,
-                    isFile: false,
-                });
-            }
+        // env variables are substituted before matching, so `$DIR/*.ts` globs the
+        // directory the task actually reads; `source` keeps the declared form.
+        const pattern = path_1.posix.normalize(toPosix((0, template_value_1.templateValue)(source, envs)));
+        const matcher = new minimatch_1.Minimatch(pattern, { dot: true });
+        if (isGlob(matcher)) {
+            // Walk from the literal directory prefix and match paths relative to the
+            // declaring task's cwd — which stays correct when the source is inherited
+            // by a dependant in another directory.
+            const prefix = literalPrefix(pattern);
+            result.push({
+                matcher: (file, _cwd, partial) => matcher.match(toPosix((0, path_1.relative)(cwd, file)), partial),
+                inherited: null,
+                source,
+                absolutePath: prefix ? (0, path_1.join)(cwd, prefix) : cwd,
+                isFile: false,
+            });
         }
         else {
-            const absolutePath = (0, path_1.join)(cwd, (0, template_value_1.templateValue)(source, envs));
+            const absolutePath = (0, path_1.join)(cwd, pattern);
             result.push({
                 matcher: (file) => file.startsWith(absolutePath),
                 absolutePath,
@@ -59,6 +46,24 @@ function parseWorkSource(cwd, sources, envs) {
     return result;
 }
 exports.parseWorkSource = parseWorkSource;
+// minimatch parses a literal path into a single set of plain strings; anything
+// else (wildcards, ?, [...], {a,b}, extglobs) is a glob.
+function isGlob(matcher) {
+    return matcher.set.length !== 1 || matcher.set[0].some((part) => typeof part !== 'string');
+}
+// The leading directories of a glob that contain no glob syntax — where the
+// walk for matching files starts.
+function literalPrefix(pattern) {
+    const segments = pattern.split('/');
+    const literal = [];
+    for (const segment of segments.slice(0, -1)) {
+        if (/[*?[\]{}()!+@]/.test(segment)) {
+            break;
+        }
+        literal.push(segment);
+    }
+    return literal.join('/');
+}
 function createSource(absolutePath) {
     return {
         matcher: (file) => file.startsWith(absolutePath),

package/dist/planner/utils/portable-path.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.portablePath = void 0;
+const os_1 = require("os");
+const path_1 = require("path");
+const toPosix = (value) => (path_1.sep === path_1.posix.sep ? value : value.split(path_1.sep).join(path_1.posix.sep));
+function within(base, path) {
+    const rel = (0, path_1.relative)(base, path);
+    if (rel.startsWith('..') || (0, path_1.isAbsolute)(rel)) {
+        return null;
+    }
+    return toPosix(rel);
+}
+// Express an absolute path in a machine-independent form for cache identity:
+// relative to the project root when inside it, relative to the home directory
+// (`~/…`) when inside that, and unchanged otherwise (a fixed system path such as
+// `/var/run/docker.sock` is already the same on every machine).
+function portablePath(projectRoot, path) {
+    const inRoot = within(projectRoot, path);
+    if (inRoot !== null) {
+        return inRoot.length > 0 ? inRoot : '.';
+    }
+    const inHome = within((0, os_1.homedir)(), path);
+    if (inHome !== null) {
+        return inHome.length > 0 ? `~/${inHome}` : '~';
+    }
+    return toPosix(path);
+}
+exports.portablePath = portablePath;
+//# sourceMappingURL=portable-path.js.map

package/dist/planner/work-cache-id.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getWorkTaskId = void 0;
 const crypto_1 = require("crypto");
 const work_task_cache_description_1 = require("../optimizer/work-task-cache-description");
-function getWorkTaskId(task) {
-    const description = (0, work_task_cache_description_1.getWorkTaskCacheDescription)(task);
+function getWorkTaskId(item) {
+    const description = (0, work_task_cache_description_1.getWorkTaskCacheDescription)(item);
     const jsonData = JSON.stringify(description);
     return (0, crypto_1.createHash)('sha1').update(jsonData).digest('hex');
 }